Grype is a vulnerability scanner for container images and filesystems. It provides comprehensive scanning capabilities to identify known vulnerabilities in your container images, dependencies, and operating system packages. Designed for enterprise security teams and DevSecOps workflows, Grype enables automated security scanning in CI/CD pipelines and supports multiple output formats for integration with existing security tools.
Core capabilities and strengths of this container
Typical scenarios where this container excels
Download the container image from the registry
docker pull clnstrt-images.cleanstart.com/$ORGANIZATION/grype:latestdocker pull clnstrt-images.cleanstart.com/$ORGANIZATION/grype:latest-devRun the container with basic configuration
docker run -it --rm clnstrt-images.cleanstart.com/$ORGANIZATION/grype:latest <image-to-scan>Deploy with production security settings
docker run -d --name grype-prod \
--read-only \
--security-opt=no-new-privileges \
--user 1000:1000 \
clnstrt-images.cleanstart.com/$ORGANIZATION/grype:latestMount local directory for persistent data
docker run -v $(pwd):/workspace clnstrt-images.cleanstart.com/$ORGANIZATION/grype:latest /workspace/my-image:latestRun with custom port mappings
docker run -p 9279:9279 clnstrt-images.cleanstart.com/$ORGANIZATION/grype:latestConfiguration options available through environment variables
https://toolbox-data.anchore.io/grype/databases/listing.jsontruetableRecommended security configurations and practices
Recommended security context for Kubernetes deployments
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]Essential links and resources for further information